From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751341AbeFDUzF (ORCPT ); Mon, 4 Jun 2018 16:55:05 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:58690 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751267AbeFDUzD (ORCPT ); Mon, 4 Jun 2018 16:55:03 -0400 From: Stefan Berger To: zohar@linux.vnet.ibm.com, paul@paul-moore.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com Cc: sgrubb@redhat.com, linux-kernel@vger.kernel.org, Stefan Berger Subject: [PATCH v3 0/4] IMA: work on audit records produced by IMA Date: Mon, 4 Jun 2018 16:54:51 -0400 X-Mailer: git-send-email 2.14.3 X-TM-AS-GCONF: 00 x-cbid: 18060420-8235-0000-0000-00000DA97C40 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00009129; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000265; SDB=6.01042340; UDB=6.00533731; IPR=6.00821470; MB=3.00021461; MTD=3.00000008; XFM=3.00000015; UTC=2018-06-04 20:55:01 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18060420-8236-0000-0000-00004156FE6B Message-Id: <20180604205455.2325754-1-stefanb@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-06-04_14:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=901 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1805220000 definitions=main-1806040238 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This series of patches cleans up some usages of the audit subsystem's API by IMA. We also introduce a new record type that IMA creates while parsing policy rules. Stefan v2->v3: - reworked patch 4; pass current->audit_context rather than NULL v1->v2: - dropped several patches that extended existing messages with missing fields - Using audit_log_task_info() for new record type in last patch - rebased on security-next; new message type is now 1807 Stefan Berger (4): ima: Call audit_log_string() rather than logging it untrusted ima: Use audit_log_format() rather than audit_log_string() ima: Do not audit if CONFIG_INTEGRITY_AUDIT is not set ima: Differentiate auditing policy rules from "audit" actions include/uapi/linux/audit.h | 1 + security/integrity/ima/Kconfig | 1 + security/integrity/ima/ima_policy.c | 9 ++++++--- security/integrity/integrity.h | 15 +++++++++++++++ security/integrity/integrity_audit.c | 6 +----- 5 files changed, 24 insertions(+), 8 deletions(-) -- 2.13.6